Bug 145142 – Crash in WebCore::RenderLayer::updateScrollbarsAfterLayout

• Status: RESOLVED
• Resolution: FIXED
• Component: Layout and Rendering

[Beth Dakin]

I have not been able to reproduce this crash, but according to symbolication m_vBar is null. It seems like this crash was probably caused by http://trac.webkit.org/changeset/173668 which made it so that overflow:scroll behaves like overflow:auto when the scrollbars are overlay. I can see how you could encounter this crash with that change if the layout caused styleRequiresScrollbar() to return true when it used to return false. Then this code, by failing to nil-check the scrollbars assumes that there is already a scrollbar, because it assumes that styleRequiresScrollbar() could not have changed based on a layout. But it could change if the css changed the scrollbars to be custom or if the user managed switch to legacy style scrollbars at just the wrong time. Or I suppose it could also happen if the user has legacy scrollbars and the style switched from auto to scroll during the layout.

Anyway, we should null check the scrollbars.


>  1 com.apple.WebCore              0x7fff93692574 WebCore::RenderLayer::updateScrollbarsAfterLayout() + 0x204
   2 com.apple.WebCore              0x7fff93691d34 WebCore::RenderLayer::updateScrollInfoAfterLayout() + 0x154
   3 com.apple.WebCore              0x7fff9410a6bd WebCore::RenderBlock::endAndCommitUpdateScrollInfoAfterLayoutTransaction() + 0x23d
   4 com.apple.WebCore              0x7fff93725c7f WebCore::RenderFlexibleBox::layoutBlock(bool, WebCore::LayoutUnit) + 0x38f
   5 com.apple.WebCore              0x7fff935dbaf3 WebCore::RenderBlock::layout() + 0x83
…

[Beth Dakin]

Created attachment 253343 [details]
Speculative fix

[Beth Dakin]

Thanks Simon! http://trac.webkit.org/changeset/184576